Lax POS security can cost your small business steep fines from credit card issuers if your system is breached. Safe password practices are one of your best defenses.
Dear Your Business Credit,
I have heard that the point-of-sale system at my store could be breached if I don’t have the right kind of password. What should I do to make sure it is secure? — Steven
This is a great question. Many small business owners are at risk of a breach at the point of sale and don’t know it. Verizon’s 2014 Data Breach Report found that 14 percent of incidents in 2013 were point-of-sale (POS) intrusions. Most victims discover their system has been breached after they are told by someone else, such as law enforcement.
POS breaches are so widespread that earlier this month, the PCI Security Standards Council, an open, global forum for the development of payment card security standards, announced it was launching the “Passwords for Payments” initiative to help merchants avoid such breaches. Poor use of passwords contributes to hackers being able to penetrate your system.
So what can you do to protect your customers’ information?
As the PCI council pointed out, criminals take advantage of easily guessed and weak passwords. One of the most common passwords is — you guessed it — “password.” If you’re using that password for your system or the default one that came with the system, change it — today! Verizon’s report suggests avoiding dictionary words, too, which are also known to be weak.
Don’t forget to put smart password protocols in place with others who have access to your system, too. If a third-party vendor maintains your system for you, have a conversation about its policies for setting passwords. Do not allow the vendor to use the same password as it does for other clients. Verizon suggests restricting remote access to your POS system by such vendors, too.
There’s a good reason for asking vendors to be cautious. In one incident in 2013, credentials were stolen from a POS vendor after being compromised by malware on that vendor’s system. The vendor had been using the same password for all of the systems it serviced at different companies. Once hackers stole that password, they were able to get their hands on information on the customers of the vendor’s client.
Verizon suggests installing anti-virus software on your POS system. Also avoid using your system to browse the Web, email, use social media or play games.
If you are in an industry that is especially vulnerable, I’d suggest setting up a meeting or phone call with your POS vendor to see if there are any other steps you should be taking. Some industries are hit harder than others by POS fraud. For instance, 75 percent of incidents in the accommodations industry are point-of-sale breaches, and 31 percent of those in retail fall into this category, according to the Verizon report. There may be special steps that your consultant recommends for people in your industry. Listen carefully. You can’t be too careful about protecting customers’ information.